EU Digital Services Act Checklist

Record the service model before building controls. The DSA defines intermediary services to include mere conduit, caching, and hosting. A hosting service stores information provided by and at the request of a recipient. An online platform is a hosting service that stores and disseminates recipient-provided information to the public, unless dissemination is only a minor and purely ancillary feature.

Also record whether the service offers online search, presents ads, uses recommender systems, is accessible to minors, or lets consumers conclude distance contracts with traders. Those facts determine which later checklist items apply.

Hosting services need an electronic mechanism for any individual or entity to notify specific items of allegedly illegal content. The notice form should collect enough information for the provider to identify the content and assess illegality without turning the form into a general complaint inbox.

When a notice includes electronic contact details, the provider should be able to acknowledge receipt, notify the submitter of the decision, and explain redress options. Moderation decisions should be logged whether they come from a notice, own-initiative review, automated detection, a trusted flagger, or an authority order.

Hosting services must give affected recipients a clear and specific statement of reasons when they restrict content, payments, service access, or an account because user-provided information is illegal or incompatible with terms. The record should be specific enough for the user to understand and challenge the decision.

Online platforms have an extra publication workflow: Article 24(5) requires statements of reasons to be sent to the Commission's DSA Transparency Database, without personal data.

Online platforms need an internal complaint-handling system for moderation and account decisions covered by Article 20. The complaint path should be electronic, free of charge, easy to access, and supervised by qualified staff rather than decided solely by automation.

Transparency reporting should be built from operational logs, not reconstructed manually at publication time. The report data needs to separate authority orders, notices, own-initiative moderation, automation, complaints, out-of-court disputes, and misuse suspensions where those categories apply.

Online platforms that present ads need real-time ad disclosures. Platforms that use recommender systems need plain-language terms explaining the main parameters and user options to modify or influence them. Platforms accessible to minors need proportionate privacy, safety, and security measures and must not use profiling-based ads when they know with reasonable certainty that the recipient is a minor.

Marketplaces and other online platforms allowing consumers to conclude distance contracts with traders need a trader traceability workflow before traders can offer products or services to EU consumers.

Do not treat a high-traffic service as a VLOP or VLOSE solely because it is large. The enhanced layer applies to online platforms and online search engines that meet the DSA active-recipient threshold and are designated by the Commission. Once designated, the checklist expands from content-moderation operations into systemic-risk governance.

The VLOP/VLOSE evidence set should be board-level and audit-ready because it includes risk assessments, mitigation measures, compliance functions, independent audits, data access duties, recommender options, and advertisement repositories.